Live API Keys Discovered in LLM Training Data Archive
Common Crawl, Azure OpenAI Service
Security researchers found thousands of live API keys and authentication credentials inside a web archive used for training large language models. The exposed secrets created risks for unauthorized access and downstream service compromises.
- fix status
- Fix status unknown
- first report
- 28 Feb 2025
- last update
- 28 Feb 2025
Timeline · 1
Sources · 1
Research and catalogues
- 2025-02-28Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security RisksAI Incident Database · incidentdatabase.ai/cite/956
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Data leakSupply chain
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- OpenAI, Microsoft, Open-weight model
- mitre atlas
- AML.T0010 AI Supply Chain Compromise
- dates
- happened 28 Feb 2025 · first reported 28 Feb 2025
- origin
- AI Incident DatabaseDerived from the AI Incident Database (CC BY-SA 4.0).
- record
- confidence 0.90 · created 2026-10-18 06:33Z · updated 2026-10-18 06:59Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Live API Keys Discovered in LLM Training Data Archive https://gcdradar.vercel.app/incidents/live-api-keys-discovered-in-llm-training-data-archive · AIR-2025-0171 · closed 2025-03-14 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2025-02-28 - AI role: Attack on AI - Products: Common Crawl, Azure OpenAI Service ## Summary Security researchers found thousands of live API keys and authentication credentials inside a web archive used for training large language models. The exposed secrets created risks for unauthorized access and downstream service compromises. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2025-02-28: Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks (https://incidentdatabase.ai/cite/956) ## Sources - 2025-02-28 AI Incident Database: Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks https://incidentdatabase.ai/cite/956 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedRAGLeak RAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented Generation
Research · since 20 Oct 2026
AI - closedopen-weight LLM Model-as-a-Trojan: Self-Activating Covert DNS Exfiltration in LLM Weights
Research · since 19 Oct 2026
AI - closedChatGPT Multiple LLM Platforms Expose Thousands of Conversations via Share Links
Breaches & attacks · Exploited · since 31 Jul 2025
AI - closedLiteLLM LiteLLM Master Key Leak Leads to Malicious Package Release
Supply chain · Exploited · since 24 Oct 2026 · updated 26 Oct 2026
AI - closedMCP servers & tools Postmark MCP Server Package Hijacked for Email Exfiltration
Supply chain · Exploited · since Sep 2025 (approx.)
AI - closed8.2Microsoft 365 Copilot CVE-2025-53787: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
Patch now · Disclosed · since 7 Aug 2025 · CVE-2025-53787
AI